# CVE-2026-14554: Check & Log Email - SQLi

> Live exploitation tracking for CVE-2026-14554 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-14554

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.5
- **Public exploit available:** Yes
- **Affected products:** WordPress Check & Log Email
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

The Check & Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

## CrowdSec analysis

[CVE-2026-14554](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-14554) is a SQL injection vulnerability in the Check & Log Email WordPress plugin versions before 2.0.15. Attackers with administrator privileges can exploit improperly sanitized parameters to manipulate database queries, potentially exposing or altering sensitive data.

CrowdSec has been tracking this vulnerability and its exploits since 30th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-14554 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers first authenticate through `/wp-login.php`, then target `/wp-admin/admin.php?page=check-email-logs` with a time-based SQL injection payload in the `d` parameter. The payload uses `AND SLEEP(6)` to probe for SQL injection.

## Timeline

- 2026-07-31: CVE Published. CVE-2026-14554 is published to NVD.
- 2026-10-30: Rule Released. CrowdSec releases a rule to detect CVE-2026-14554 exploitation attempts against the CrowdSec Network.

## References

- https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14554.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-14554) follows observed exploitation activity for CVE-2026-14554. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.